CVE-2025-68820: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4_raw_inode() If ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED), iloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all() lacks error checking, this will lead to a null pointer dereference in ext4_raw_inode(), called right after ext4_get_inode_loc(). Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected products

• Linux Linux: from 5.10.237, before 5.10.248 (fixed in 5.10.248); from 5.15.181, before 5.15.198 (fixed in 5.15.198); from 6.1.135, before 6.1.160 (fixed in 6.1.160); from 6.6.88, before 6.6.120 (fixed in 6.6.120); from 6.12.24, before 6.12.64 (fixed in 6.12.64); from 5.4.293, before 5.5 (fixed in 5.5); …
• Siemens SIMATIC s7-1500 CPU 1518-4 Pn/dp Mfp: from V3.1.6
• Siemens SIMATIC s7-1500 CPU 1518f-4 Pn/dp Mfp: from V3.1.6
• Siemens Siplus s7-1500 CPU 1518-4 Pn/dp Mfp: from V3.1.6

Published 2026-01-13. Last modified 2026-07-14.